UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
181
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 5.5

    CVE-2025-64422 · Coolify

    Rate-limit bypass on login via X-Forwarded-Host header

    Published 3 Jan 2026 · Fixed in 4.0.0-beta.435, 4.0.0 · NVD, Project advisories (GitHub)
  2. High 8.8

    CVE-2025-64420 · Coolify

    Members can see private key of root user

    Published 3 Jan 2026 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)
  3. High 8.8

    CVE-2025-64419 · Coolify

    Command injection via docker-compose.yaml parameters

    Published 3 Jan 2026 · Fixed in 4.0.0-beta.436, 4.0.0 · NVD, Project advisories (GitHub)
  4. Medium 3.7

    CVE-2025-15284 · qs

    qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

    Published 30 Dec 2025 · Fixed in 6.14.1 · OSV.dev and GitHub
  5. Medium 6.3

    CVE-2025-64528 · Discourse

    Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when `enable_names` is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.

    Published 30 Dec 2025 · Fixed in 3.5.3 · NVD
  6. High 8.2

    CVE-2025-14180 · PHP

    In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in…

    Published 27 Dec 2025 · Fixed in 8.3.29, 8.4.16, 8.5.1 · NVD
  7. High 8.2

    CVE-2025-14178 · PHP

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes…

    Published 27 Dec 2025 · Fixed in 8.3.29, 8.4.16, 8.5.1 · NVD
  8. Medium 6.3

    CVE-2025-14177 · PHP

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the…

    Published 27 Dec 2025 · Fixed in 8.2.30, 8.3.29, 8.4.16 · NVD
  9. Critical 9.4

    CVE-2025-66213 · Coolify

    Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path

    Published 23 Dec 2025 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)
  10. Critical 9.4

    CVE-2025-66212 · Coolify

    Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename

    Published 23 Dec 2025 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)
  11. Critical 9.4

    CVE-2025-66211 · Coolify

    Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename

    Published 23 Dec 2025 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)
  12. Critical 9.4

    CVE-2025-66210 · Coolify

    Authenticated Remote Code Execution via Command Injection in Database Import

    Published 23 Dec 2025 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)
  13. High 8.8

    CVE-2025-66209 · Coolify

    Authenticated Remote Code Execution via Command Injection in Database Backup

    Published 23 Dec 2025 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)
  14. Medium 6.5

    CVE-2025-15033 · WooCommerce

    WooCommerce: Exposure of Sensitive Information to an Unauthorized Actor

    Published 22 Dec 2025 · Fixed in 10.4.3 · WPVulnerability
  15. High 8.7Actively exploited

    CVE-2025-14847 · MongoDB

    Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB…

    Published 19 Dec 2025 · Fixed in 7.0.28, 8.0.17, 8.2.3 · NVD
  16. Medium 4.9

    CVE-2025-68390 · Elasticsearch

    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.

    Published 18 Dec 2025 · Fixed in 8.19.8, 9.1.8, 9.2.2 · NVD
  17. Medium 6.5

    CVE-2025-68384 · Elasticsearch

    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.

    Published 18 Dec 2025 · Fixed in 8.19.9, 9.1.9, 9.2.3 · NVD
  18. Medium 4.3

    CVE-2025-13750 · Webp Converter For Media (WordPress plugin)

    Converter for Media – Optimize images | Convert WebP & AVIF: Missing Authorization

    Published 16 Dec 2025 · Fixed in 6.4.0 · WPVulnerability
  19. Unrated

    CVE-2025-66491 · github.com/traefik/traefik, Traefik

    Traefik Inverted TLS Verification Logic in ingress-nginx Provider in github.com/traefik/traefik

    Published 15 Dec 2025 · Fixed in 3.6.3 · OSV.dev and GitHub
  20. High 7.4

    CVE-2025-37731 · Elasticsearch

    Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

    Published 15 Dec 2025 · Fixed in 8.19.8, 9.1.8, 9.2.2 · NVD
  21. Medium 6.5

    CVE-2026-94674 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Cross-site Scripting

    Published 15 Dec 2025 · Fixed in 1.69.1 · WPVulnerability
  22. Medium 6.4

    CVE-2025-11220 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 15 Dec 2025 · Fixed in 3.33.4 · WPVulnerability
  23. High 7.5

    GHSA-5j59-xgg2-r9c4 · Next.js

    Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

    Published 12 Dec 2025 · Fixed in 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19 · OSV.dev and GitHub
  24. Medium 4.3

    CVE-2025-64011 · Nextcloud

    Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions.

    Published 12 Dec 2025 · NVD
  25. Medium 5.3

    GHSA-w37m-7fhw-fmv9 · Next.js

    Next Server Actions Source Code Exposure

    Published 11 Dec 2025 · Fixed in 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17 · OSV.dev and GitHub
  26. High 7.5

    GHSA-mwv6-3258-q52c · Next.js

    Next Vulnerable to Denial of Service with Server Components

    Published 11 Dec 2025 · Fixed in 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17 · OSV.dev and GitHub
  27. Low 3.5

    CVE-2025-12734 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to, under certain conditions, render content in dialogs to other users by injecting malicious HTML content into merge request titles.

    Published 11 Dec 2025 · Fixed in 18.4.6, 18.5.4, 18.6.2 · NVD
  28. High 8.0

    CVE-2025-12029 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI."

    Published 11 Dec 2025 · Fixed in 18.4.6, 18.5.4, 18.6.2 · NVD
  29. High 7.7

    CVE-2025-8405 · GitLab

    GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.

    Published 11 Dec 2025 · Fixed in 18.4.6, 18.5.4, 18.6.2 · NVD
  30. Medium 6.5

    CVE-2025-4097 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a denial of service condition by uploading specially crafted images.

    Published 11 Dec 2025 · Fixed in 18.4.6, 18.5.4, 18.6.2 · NVD
  31. Medium 6.8

    CVE-2025-11984 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to bypass WebAuthn two-factor authentication by manipulating the session state under certain conditions.

    Published 11 Dec 2025 · Fixed in 18.4.6, 18.5.4, 18.6.2 · NVD
  32. Medium 4.3

    CVE-2025-11247 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries.

    Published 11 Dec 2025 · Fixed in 18.4.6, 18.5.4, 18.6.2 · NVD
  33. Medium 6.5

    CVE-2025-14157 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 6.3 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a Denial of Service condition by sending crafted API calls with large content parameters.

    Published 11 Dec 2025 · Fixed in 18.4.6, 18.5.4, 18.6.2 · NVD
  34. Medium 4.3

    CVE-2025-13978 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to discover the names of private projects they do not have access through API requests.

    Published 11 Dec 2025 · Fixed in 18.4.6, 18.5.4, 18.6.2 · NVD
  35. High 8.7

    CVE-2025-12716 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with malicious content.

    Published 11 Dec 2025 · Fixed in 18.4.6, 18.5.4, 18.6.2 · NVD
  36. High 7.5

    CVE-2025-12562 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted GraphQL queries that bypass query complexity limits.

    Published 11 Dec 2025 · Fixed in 18.4.6, 18.5.4, 18.6.2 · NVD
  37. Low 2.3

    CVE-2025-14345 · MongoDB

    A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those…

    Published 9 Dec 2025 · Fixed in 7.0.26, 8.0.16, 8.2.2 · NVD
  38. Medium 5.3

    CVE-2025-67564 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Exposure of Sensitive System Information to an Unauthorized Control Sphere

    Published 9 Dec 2025 · Fixed in 1.52.0 · WPVulnerability
  39. Medium 5.9

    CVE-2025-62408 · c-ares

    c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

    Published 8 Dec 2025 · Fixed in 1.34.6 · NVD
  40. High 8.5

    CVE-2025-67950 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): SQL Injection

    Published 6 Dec 2025 · Fixed in 4.9.1.1 · WPVulnerability
  41. Medium 4.3

    CVE-2025-66552 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.

    Published 5 Dec 2025 · Fixed in 30.0.9, 31.0.1 · NVD
  42. Medium 4.3

    CVE-2025-66547 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.

    Published 5 Dec 2025 · Fixed in 31.0.1 · NVD
  43. Medium 6.1

    CVE-2025-66512 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page.

    Published 5 Dec 2025 · Fixed in 31.0.12, 32.0.3 · NVD
  44. Medium 4.9

    CVE-2025-66510 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that…

    Published 5 Dec 2025 · Fixed in 30.0.17.3, 31.0.10, 32.0.1 · NVD
  45. Medium 6.4

    CVE-2024-9183 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have allowed an authenticated user to obtain credentials from higher-privileged users and perform actions in their context under specific conditions.

    Published 5 Dec 2025 · Fixed in 18.4.5, 18.5.3, 18.6.1 · NVD
  46. High 8.3

    CVE-2025-58098 · Apache HTTP Server

    Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

    Published 5 Dec 2025 · Fixed in 2.4.66 · NVD
  47. Medium 5.4

    CVE-2025-66200 · Apache HTTP Server

    mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

    Published 5 Dec 2025 · Fixed in 2.4.66 · NVD
  48. Medium 6.5

    CVE-2025-65082 · Apache HTTP Server

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65. Users are recommended to upgrade to version 2.4.66 which fixes the issue.

    Published 5 Dec 2025 · Fixed in 2.4.66 · NVD
  49. High 7.5

    CVE-2025-59775 · Apache HTTP Server

    Server-Side Request Forgery (SSRF) vulnerability  in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off  allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

    Published 5 Dec 2025 · Fixed in 2.4.66 · NVD
  50. High 7.5

    CVE-2025-55753 · Apache HTTP Server

    An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

    Published 5 Dec 2025 · Fixed in 2.4.66 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.